Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
Gambling Goblin installs malicious Apache modules on Brazilian government sites to push betting pages.
Run Apache?
Get an email when a reviewed story names Apache, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A Chinese-speaking cybercrime group, Gambling Goblin, is compromising Brazilian government and educational web servers using malicious Apache modules. These modules redirect visitors to fake app store pages that promote online gambling and sports betting, likely to manipulate search engine rankings. The group also deploys various tools including downloaders, backdoors, and credential stealers.
The lesson from this incident
Full lessonThe Gambling Goblin threat group exploited poorly secured Brazilian government and educational web servers by installing malicious Apache modules that silently redirect legitimate visitor traffic to fraudulent gambling pages. The root cause lies in inadequate server hardening, insufficient integrity monitoring of web server components, and a failure to detect unauthorized module installations. This attack is particularly damaging because it abuses the implicit trust users place in official government domains, potentially exposing citizens to scams and malware. Additionally, the deployment of backdoors and credential stealers means the compromise extends far beyond traffic hijacking, putting sensitive government data and systems at continued risk.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- malware — DownPro
- malware — AlphaAgent
- malware — oRAT
- malware — 3snake
- malware — Xnote